Overview

overview

10

Static

static

10

2025-01-21...ry.exe

windows7-x64

10

2025-01-21...ry.exe

windows10-2004-x64

10

Resubmissions

24-01-2025 15:20

250124-sqxpmawncj 10

22-01-2025 17:56

250122-wjahasypaj 10

21-01-2025 17:40

250121-v8zcaawjcj 10

21-01-2025 15:38

250121-s26fxa1ndk 10

21-01-2025 14:09

250121-rglekaxlcw 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2025-01-21_07244d8bbd0721454ea97e696b6e85d3_wannacry

  • Size

    352KB

  • Sample

    250121-rglekaxlcw

  • MD5

    07244d8bbd0721454ea97e696b6e85d3

  • SHA1

    06bc9b13360ac74b019cab18c96cc888474afc52

  • SHA256

    6d4fdb81ba3d3005f83e87f1b28fd48fbfe213a6dd164b95d939b9391faff82e

  • SHA512

    73c5fa9ee0bf8f91daa41f15932b0138329990d192bda0b75b90bd2f70fc8aaab28f509c9562355942a0563c418c96f99c0322e149e8c9b6d8ff83f14e3a8061

  • SSDEEP

    6144:gV3r9iXlkEt9RGv5IKp/ntL2FJGAJRaWJ1rQPNDEDKx22LV:gglkEHshIKpvtg4AJRaWkp

Score
10/10
chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

Malware Config

Targets

    • Target

      2025-01-21_07244d8bbd0721454ea97e696b6e85d3_wannacry

    • Size

      352KB

    • MD5

      07244d8bbd0721454ea97e696b6e85d3

    • SHA1

      06bc9b13360ac74b019cab18c96cc888474afc52

    • SHA256

      6d4fdb81ba3d3005f83e87f1b28fd48fbfe213a6dd164b95d939b9391faff82e

    • SHA512

      73c5fa9ee0bf8f91daa41f15932b0138329990d192bda0b75b90bd2f70fc8aaab28f509c9562355942a0563c418c96f99c0322e149e8c9b6d8ff83f14e3a8061

    • SSDEEP

      6144:gV3r9iXlkEt9RGv5IKp/ntL2FJGAJRaWJ1rQPNDEDKx22LV:gglkEHshIKpvtg4AJRaWkp

    Score
    10/10
    chaosdefense_evasionevasionexecutionimpactransomwarespywarestealer

    • Chaos

      Ransomware family first seen in June 2021.

      ransomwarechaos

    • Chaos Ransomware

    • Chaos family

      chaos

    • Deletes shadow copies

      Ransomware often targets backup files to inhibit system recovery.

      ransomwaredefense_evasionimpactexecution

    • Modifies boot configuration data using bcdedit

      ransomwareevasion

    • Deletes backup catalog

      Uses wbadmin.exe to inhibit system recovery.

      ransomware

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Drops desktop.ini file(s)

    • Sets desktop wallpaper using registry

      ransomware
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks